rein-aharness/docs/request-admission.md

Child request reservations in the worker envelope

rein_aharness.request_admission.RequestLedger implements llm-connect's owner-hosted Messages meter in the existing private SpendLedger database. It introduces no second daily/total allowance and does not install a service.

The trusted provisioning path calls RequestLedger.initialize() before any run reservation. Missing tables or state refuse; initialization is additive and cannot reset existing request tables. After the normal validated parent dispatch reservation, the owner calls bind_route(run_id, policy_sha256, lease_id=..., expires_at=...) with the real accepted lease expiry. This returns one random token whose hash is stored with run, lease, exact request policy and expiry. The owner supplies that token and the gateway URL to the workload; no provider key or ledger path belongs in the sandbox. There is no replacement/renewal path for a run; expiry or revocation requires owner handling, not workload replay.

Each forward first commits a child hold in micro-USD. Requests serialize with SQLite BEGIN IMMEDIATE; a pending or unknown request blocks additional calls. Sum of full child liabilities cannot exceed the parent's admitted USD maximum. Trusted terminal usage charges the full child reservation without refunds. Known overrun records the larger amount and freezes the whole envelope. Request receipts contain only bounded IDs/digests, amounts, times and disposition.

Parent observation revokes the route, including unknown accounting results. Even an apparent successful CLI result cannot settle a parent with pending child requests. Existing operator reconciliation still requires attested provider termination and final accounting; it settles child holds conservatively and never reopens a route or grants another demand attempt. revoke_route is the trusted callback for real lease loss; an expiry also denies new admissions. In-flight cancellation retains liability until outcome is known.

The downstream protocol is documented in llm-connect/contracts/functional/messages-admission.md (LLM-WP-0009). The default worker/serve configurations do not yet host or inject this route. REINAH-WP-0003-T05/T06 and LLM-WP-0009-T03 retain protected owner hosting, real lease/token wiring, provider custody, enforced egress and bypass proof, accepted tariffs/FX, runtime installation and admitted real-profile/queue execution.

The installed-CLI fake-provider proof uses synthetic bounds and dummy keys. With a USD 0.01 parent the same native request is refused with zero upstream calls; with adequate fixture capacity a two-request tool session succeeds. That verifies request admission and accounting, not a live EUR ceiling or owner/workload secret and network separation.